CVE-2024-39946

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-31 · updated 2026-06-17

Description

A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing device initialization.

Affected products

Dahuasecurity Nvr4104-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4104-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4104-P-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4104-P-4Ks3(960G) Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4104-P-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4104Hs-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4104Hs-4Ks3(960G) Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4104Hs-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4104Hs-P-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4104Hs-P-4Ks3(960G) Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4104Hs-P-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4108-4Ks2/L Firmware: 4.003.0000000.1.r.240515
Dahuasecurity Nvr4108-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4108-8P-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4108-8P-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4108-P-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4108-P-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4108Hs-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4108Hs-4Ks3(960G) Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4108Hs-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4108Hs-8P-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4108Hs-8P-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4108Hs-P-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4108Hs-P-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4116-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4116-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4116-8P-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4116-8P-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312
Dahuasecurity Nvr4116Hs-4Ks2/L Firmware: before 4.003.0000000.1.r.240515 — fixed in 4.003.0000000.1.r.240515
Dahuasecurity Nvr4116Hs-4Ks3 Firmware: before 4.003.0000000.0.r.240312 — fixed in 4.003.0000000.0.r.240312

How to fix

Upgrade to a fixed version: Dahuasecurity Nvr4104-4Ks2/L Firmware 4.003.0000000.1.r.240515; Dahuasecurity Nvr4104-4Ks3 Firmware 4.003.0000000.0.r.240312; Dahuasecurity Nvr4104-P-4Ks2/L Firmware 4.003.0000000.1.r.240515; Dahuasecurity Nvr4104-P-4Ks3(960G) Firmware 4.003.0000000.0.r.240312; Dahuasecurity Nvr4104-P-4Ks3 Firmware 4.003.0000000.0.r.240312; Dahuasecurity Nvr4104Hs-4Ks2/L Firmware 4.003.0000000.1.r.240515; Dahuasecurity Nvr4104Hs-4Ks3(960G) Firmware 4.003.0000000.0.r.240312; Dahuasecurity Nvr4104Hs-4Ks3 Firmware 4.003.0000000.0.r.240312; Dahuasecurity Nvr4104Hs-P-4Ks2/L Firmware 4.003.0000000.1.r.240515; Dahuasecurity Nvr4104Hs-P-4Ks3(960G) Firmware 4.003.0000000.0.r.240312; Dahuasecurity Nvr4104Hs-P-4Ks3 Firmware 4.003.0000000.0.r.240312; Dahuasecurity Nvr4108-4Ks3 Firmware 4.003.0000000.0.r.240312. Check the vendor advisory for mitigations.

References

https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768

Get alerted when CVE-2024-39946 or the next vulnerability affects your stack